New AI-Powered Malware Steals Personal Data and Ranks Victims by Financial Worth
The malware compiles stolen data into dossiers and uses large language models to rank victims by value, researchers said.
- Cisco Talos researchers identified a new infostealer, dubbed 'Volta-Autodoxer,' that integrates LLM capabilities to automatically profile victims and surface high-value targets for attackers.
- Infostealers typically harvest credentials like passwords and cookies from infected machines, but Volta expands this by analyzing personal data from Gmail to build detailed victim profiles.
- The malware extracts receipts and order history from services like UberEats and DoorDash, feeding findings into LLMs like Anthropic's Claude Opus 4.6 for structured analysis.
- To evade guardrails, Volta includes fallbacks to the Chinese open-weight Moonshot Kimi and Google's Gemini 2.5 Flash, ensuring uninterrupted dossier creation.
- Talos flagged this tool using its new CAIRN framework, highlighting how hackers increasingly use LLMs to augment malware following years of credential-theft breaches at companies like Disney.
6 Articles
6 Articles
Cisco Talos' security company detected the emergence of a new malignant data collection software capable of using anthropic and Google models despite the constraints placed on them. How is that possible?
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
Cisco Finds New Malware That Uses Claude AI to Identify & Target the Most Valuable Victims
A new Windows infostealer malware called VOLTA-AUTODOXER uses commercial AI models to help cybercriminals profile victims and prioritise stolen accounts based on their value.Cisco Talos, the cybersecurity research and threat intelligence division of Cisco, stated on its research blog, published by Ryan Fetterman, on 31 October 2026 titled "Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer". Cisco Talos disclosed VOLTA-…
Coverage Details
Bias Distribution
- 60% of the sources lean Left
Factuality
To view factuality data please Upgrade to Premium
